Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,365 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1226 | CVE-2026-94127F5 — F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 29 days | 75 | 9.3 | 2.2% · 82.6th | 2026-09-22 | 2026-09-25CISA federal deadline · Overdue by 29 days |
| 1227 | CVE-2021-1782Apple — Apple Multiple Products Race Condition VulnerabilityKEV since 2021 · listed over a year | 75 | 7.0 | 2.2% · 82.6th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1228 | CVE-2025-21043Samsung — Samsung Mobile Devices Out-of-Bounds Write VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 2.2% · 82.5th | 2025-10-02 | 2025-10-23KEV since 2025 · listed over a year |
| 1229 | CVE-2026-104286Fortinet — Fortinet FortiMail Path Traversal VulnerabilityCISA federal deadline · Overdue by 20 days | 75 | 9.8 | 2.2% · 82.4th | 2026-10-01 | 2026-10-04CISA federal deadline · Overdue by 20 days |
| 1230 | CVE-2026-34621Adobe — Adobe Acrobat and Reader Prototype Pollution VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 8.6 | 2.2% · 82.2nd | 2026-04-13 | 2026-04-27CISA federal deadline · Overdue by 6 months |
| 1231 | CVE-2020-9819Apple — Apple iOS, iPadOS, and watchOS Memory Corruption VulnerabilityKEV since 2021 · listed over a year | 75 | 4.3 | 2.2% · 82.2nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1232 | CVE-2017-12232Cisco — Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 2.2% · 82nd | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1233 | CVE-2017-6663Cisco — Cisco IOS Software and Cisco IOS XE Software Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 2.1% · 81.7th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1234 | CVE-2026-49869Kestra — Kestra OSS OS Command Injection VulnerabilityCISA federal deadline · Overdue by 49 days | 75 | 10.0 | 2.1% · 81.5th | 2026-09-02 | 2026-09-05CISA federal deadline · Overdue by 49 days |
| 1235 | CVE-2023-6448Unitronics — Unitronics Vision PLC and HMI Insecure Default Password VulnerabilityKEV since 2023 · listed over a year | 75 | 9.8 | 2.1% · 81.5th | 2023-12-11 | 2023-12-18KEV since 2023 · listed over a year |
| 1236 | CVE-2026-45247Mirasvit — Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 9.3 | 2.1% · 81.4th | 2026-06-03 | 2026-06-06CISA federal deadline · Overdue by 5 months |
| 1237 | CVE-2017-12238Cisco — Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 2.0% · 80.8th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1238 | CVE-2025-0111Palo Alto Networks — Palo Alto Networks PAN-OS File Read VulnerabilityKEV since 2025 · listed over a year | 75 | 7.1 | 2.0% · 80.6th | 2025-02-20 | 2025-03-13KEV since 2025 · listed over a year |
| 1239 | CVE-2020-2506QNAP Systems — QNAP Helpdesk Improper Access Control VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 2.0% · 80.4th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 1240 | CVE-2023-41974Apple — Apple iOS and iPadOS Use-After-Free VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 7.8 | 2.0% · 80.1st | 2026-03-05 | 2026-03-26CISA federal deadline · Overdue by 7 months |
| 1241 | CVE-2025-8875N-able — N-able N-Central Insecure Deserialization VulnerabilityKEV since 2025 · listed over a year | 75 | 9.4 | 1.9% · 79.5th | 2025-08-13 | 2025-08-20KEV since 2025 · listed over a year |
| 1242 | CVE-2025-27920Srimax — Srimax Output Messenger Directory Traversal VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 1.9% · 79.1st | 2025-05-19 | 2025-06-09KEV since 2025 · listed over a year |
| 1243 | CVE-2025-59689Libraesva — Libraesva Email Security Gateway Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 6.1 | 1.9% · 79.1st | 2025-09-29 | 2025-10-20KEV since 2025 · listed over a year |
| 1244 | CVE-2026-76504Cisco — Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCISA federal deadline · Overdue by 21 days | 75 | 9.8 | 1.8% · 78.6th | 2026-09-30 | 2026-10-03CISA federal deadline · Overdue by 21 days |
| 1245 | CVE-2018-19322GIGABYTE — GIGABYTE Multiple Products Code Execution VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 7.8 | 1.8% · 78.5th | 2022-10-24 | 2022-11-14KEV since 2022 · listed over a year |
| 1246 | CVE-2026-34909Ubiquiti — Ubiquiti UniFi OS Path Traversal VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 10.0 | 1.8% · 78.3rd | 2026-06-23 | 2026-06-26CISA federal deadline · Overdue by 4 months |
| 1247 | CVE-2024-7694TeamT5 — TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 7.2 | 1.8% · 78.2nd | 2026-02-17 | 2026-03-10CISA federal deadline · Overdue by 7 months |
| 1248 | CVE-2025-15556Notepad++ — Notepad++ Download of Code Without Integrity Check VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 7.7 | 1.8% · 78th | 2026-02-12 | 2026-03-05CISA federal deadline · Overdue by 8 months |
| 1249 | CVE-2025-22226VMware — VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityKEV since 2025 · listed over a year | 75 | 6.0 | 1.8% · 78th | 2025-03-04 | 2025-03-25KEV since 2025 · listed over a year |
| 1250 | CVE-2026-33634Aquasecurity — Aquasecurity Trivy Embedded Malicious Code VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 9.4 | 1.7% · 77.7th | 2026-03-26 | 2026-04-09CISA federal deadline · Overdue by 7 months |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.